CVE-2015-8862: Cross-Site Scripting in mustache
Summary
CVE-2015-8862: Cross-Site Scripting in mustache. Affects mustache versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Also tracked for
- mustache.js · Debian:11
The same CVE-2015-8862 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mustache package is an npm package used for implementing logic-less templates. It provides a simple and lightweight way to render templates by replacing placeholders with actual values. However, versions prior to 2.2.1 are vulnerable to a cross-site scripting (XSS) attack when attributes in mustache templates are not properly quoted. This vulnerability allows an attacker to inject malicious code into the rendered HTML, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability arises from the lack of proper quoting of attributes in mustache templates. When an attribute is not enclosed in quotes, an attacker can manipulate the attribute value to include malicious code. For example, an attacker could inject a script that executes arbitrary JavaScript code when the template is rendered. This can be particularly dangerous when the template includes user-controlled input, as it allows the attacker to execute code within the context of the user's browser. The impact of this vulnerability depends on the specific use case and the sensitivity of the data being processed by the template.
How To Fix
Latest published version: 4.2.0 as of 22 Oct 2026
npm install mustache@4.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.1
This is the first release that contains the fix.
npm install mustache@2.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to manually ensure that all attributes in mustache templates are encapsulated with quotes. For example, instead of using <a href={{foo}}/>, the template should be modified to <a href="{{foo}}"/>. This ensures that the attribute value is treated as a string and prevents the injection of malicious code.
Conclusion
The mustache package prior to version 2.2.1 is vulnerable to a cross-site scripting (XSS) attack when attributes in mustache templates are not properly quoted. This can lead to unauthorized access, data theft, or the execution of arbitrary code within the user's browser. To mitigate this vulnerability, it is recommended to update to version 2.2.1 or later of the mustache package. Alternatively, manually ensuring that all attributes in mustache templates are encapsulated with quotes can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mustache →
FAQ
The impact of this vulnerability depends on the specific use case and the sensitivity of the data being processed by the template. In general, it can lead to unauthorized access, data theft, or the execution of arbitrary code within the context of the user's browser.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
While specific exploits targeting this vulnerability may exist, there are no publicly known exploits at the time of this report. However, it is important to address the vulnerability promptly to prevent potential exploitation.
Yes, updating to version 2.2.1 or later of the mustache package fixes this vulnerability. It is recommended to update the package as soon as possible to ensure the security of your application.
Yes, a temporary workaround is to manually ensure that all attributes in mustache templates are encapsulated with quotes. This prevents the injection of malicious code. However, updating the package to the latest version is the recommended long-term solution.
Related vulnerabilities
Recent vulnerabilities recorded for mustache.
